kirograph 0.17.0 → 0.19.0

package/dist/security/integrator.test.js

@@ -0,0 +1,237 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var import_vitest = require("vitest");
+var fs = __toESM(require("fs"));
+var path = __toESM(require("path"));
+var os = __toESM(require("os"));
+var import_integrator = require("./integrator");
+var import_database = require("../db/database");
+(0, import_vitest.describe)("DependencyGraphIntegrator.cleanup()", () => {
+  let db;
+  let integrator;
+  let tmpDir;
+  const projectRoot = "/tmp/test-project";
+  (0, import_vitest.beforeEach)(() => {
+    tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), "kirograph-integrator-test-"));
+    db = new import_database.GraphDatabase(tmpDir);
+    db.applySecuritySchema();
+    integrator = new import_integrator.DependencyGraphIntegrator(db, projectRoot);
+  });
+  (0, import_vitest.afterEach)(() => {
+    db.close();
+    fs.rmSync(tmpDir, { recursive: true, force: true });
+  });
+  function createDependencyNode(name, ecosystem, sourceManifests, options) {
+    const nodeId = `dep:${ecosystem}:${name}`;
+    const rawDb = db.getRawDb();
+    const node = {
+      id: nodeId,
+      kind: "dependency",
+      name,
+      qualifiedName: `${ecosystem}/${name}`,
+      filePath: sourceManifests[0] ?? "",
+      language: "unknown",
+      startLine: 0,
+      endLine: 0,
+      startColumn: 0,
+      endColumn: 0,
+      isExported: false,
+      isAsync: false,
+      isStatic: false,
+      isAbstract: false,
+      updatedAt: Date.now()
+    };
+    db.upsertNode(node);
+    rawDb.run(
+      `INSERT OR REPLACE INTO sec_dependencies
+        (node_id, ecosystem, package_name, declared_constraint, resolved_version, scope, source_manifests)
+       VALUES (?, ?, ?, ?, ?, ?, ?)`,
+      [nodeId, ecosystem, name, "^1.0.0", "1.0.0", "production", JSON.stringify(sourceManifests)]
+    );
+    if (options?.addDeclaredInEdge !== false) {
+      for (const manifest of sourceManifests) {
+        const edge = {
+          source: nodeId,
+          target: manifest,
+          kind: "declared_in"
+        };
+        db.insertEdge(edge);
+      }
+    }
+    return nodeId;
+  }
+  function createEdge(source, target, kind) {
+    const edge = {
+      source,
+      target,
+      kind
+    };
+    db.insertEdge(edge);
+  }
+  (0, import_vitest.it)("should return zero counts when no dependencies exist", async () => {
+    const result = await integrator.cleanup(() => true);
+    (0, import_vitest.expect)(result.nodesRemoved).toBe(0);
+    (0, import_vitest.expect)(result.edgesRemoved).toBe(0);
+  });
+  (0, import_vitest.it)("should not remove dependencies whose manifests still exist and have declared_in edges", async () => {
+    const manifestPath = "package.json";
+    const nodeId = createDependencyNode("express", "npm", [manifestPath]);
+    const manifestExists = () => true;
+    const result = await integrator.cleanup(manifestExists);
+    (0, import_vitest.expect)(result.nodesRemoved).toBe(0);
+    (0, import_vitest.expect)(result.edgesRemoved).toBe(0);
+    const node = db.getNode(nodeId);
+    (0, import_vitest.expect)(node).not.toBeNull();
+  });
+  (0, import_vitest.it)("should remove dependencies with no declared_in edges", async () => {
+    const manifestPath = "package.json";
+    const nodeId = createDependencyNode("express", "npm", [manifestPath], {
+      addDeclaredInEdge: false
+    });
+    const manifestExists = () => true;
+    const result = await integrator.cleanup(manifestExists);
+    (0, import_vitest.expect)(result.nodesRemoved).toBe(1);
+    const node = db.getNode(nodeId);
+    (0, import_vitest.expect)(node).toBeNull();
+  });
+  (0, import_vitest.it)("should remove dependencies whose manifests no longer exist on disk", async () => {
+    const manifestPath = "package.json";
+    const nodeId = createDependencyNode("express", "npm", [manifestPath]);
+    const manifestExists = () => false;
+    const result = await integrator.cleanup(manifestExists);
+    (0, import_vitest.expect)(result.nodesRemoved).toBe(1);
+    const node = db.getNode(nodeId);
+    (0, import_vitest.expect)(node).toBeNull();
+  });
+  (0, import_vitest.it)("should remove edges connected to orphaned nodes", async () => {
+    const manifestPath = "package.json";
+    const depNodeId = createDependencyNode("lodash", "npm", [manifestPath], {
+      addDeclaredInEdge: false
+    });
+    const codeNode = {
+      id: "file:src/index.ts:import:lodash",
+      kind: "import",
+      name: "lodash",
+      qualifiedName: "src/index.ts:lodash",
+      filePath: "src/index.ts",
+      language: "typescript",
+      startLine: 1,
+      endLine: 1,
+      startColumn: 0,
+      endColumn: 20,
+      updatedAt: Date.now()
+    };
+    db.upsertNode(codeNode);
+    createEdge(codeNode.id, depNodeId, "imports");
+    const manifestExists = () => true;
+    const result = await integrator.cleanup(manifestExists);
+    (0, import_vitest.expect)(result.nodesRemoved).toBe(1);
+    (0, import_vitest.expect)(result.edgesRemoved).toBe(1);
+  });
+  (0, import_vitest.it)("should keep dependency if at least one source manifest exists on disk", async () => {
+    const manifests = ["packages/a/package.json", "packages/b/package.json"];
+    const nodeId = createDependencyNode("react", "npm", manifests);
+    const manifestExists = (p) => p.includes("packages/a/package.json");
+    const result = await integrator.cleanup(manifestExists);
+    (0, import_vitest.expect)(result.nodesRemoved).toBe(0);
+    const node = db.getNode(nodeId);
+    (0, import_vitest.expect)(node).not.toBeNull();
+  });
+  (0, import_vitest.it)("should remove transitive dependencies no longer reachable from direct deps", async () => {
+    const manifest = "package.json";
+    const directId = createDependencyNode("express", "npm", [manifest]);
+    const reachableTransId = createDependencyNode("accepts", "npm", [manifest]);
+    createEdge(directId, reachableTransId, "depends_on");
+    const orphanedDirectId = createDependencyNode("lodash", "npm", ["old-package.json"], {
+      addDeclaredInEdge: false
+    });
+    const unreachableTransId = createDependencyNode("lodash.merge", "npm", ["old-package.json"], {
+      addDeclaredInEdge: false
+    });
+    createEdge(orphanedDirectId, unreachableTransId, "depends_on");
+    const manifestExists = () => true;
+    const result = await integrator.cleanup(manifestExists);
+    (0, import_vitest.expect)(result.nodesRemoved).toBe(2);
+    (0, import_vitest.expect)(db.getNode(directId)).not.toBeNull();
+    (0, import_vitest.expect)(db.getNode(reachableTransId)).not.toBeNull();
+    (0, import_vitest.expect)(db.getNode(orphanedDirectId)).toBeNull();
+    (0, import_vitest.expect)(db.getNode(unreachableTransId)).toBeNull();
+  });
+  (0, import_vitest.it)("should handle transitive chains correctly \u2014 all reachable from direct dep", async () => {
+    const manifest = "package.json";
+    const directId = createDependencyNode("express", "npm", [manifest]);
+    const bp = createDependencyNode("body-parser", "npm", [manifest]);
+    const rb = createDependencyNode("raw-body", "npm", [manifest]);
+    const bytes = createDependencyNode("bytes", "npm", [manifest]);
+    createEdge(directId, bp, "depends_on");
+    createEdge(bp, rb, "depends_on");
+    createEdge(rb, bytes, "depends_on");
+    const manifestExists = () => true;
+    const result = await integrator.cleanup(manifestExists);
+    (0, import_vitest.expect)(result.nodesRemoved).toBe(0);
+    (0, import_vitest.expect)(result.edgesRemoved).toBe(0);
+  });
+  (0, import_vitest.it)("should count edges correctly when multiple edges connect to orphaned node", async () => {
+    const orphanedManifest = "removed/package.json";
+    const depId = createDependencyNode("old-pkg", "npm", [orphanedManifest], {
+      addDeclaredInEdge: false
+    });
+    const codeNode1 = {
+      id: "node:a",
+      kind: "function",
+      name: "funcA",
+      qualifiedName: "funcA",
+      filePath: "src/a.ts",
+      language: "typescript",
+      startLine: 1,
+      endLine: 5,
+      startColumn: 0,
+      endColumn: 0,
+      updatedAt: Date.now()
+    };
+    const codeNode2 = {
+      id: "node:b",
+      kind: "function",
+      name: "funcB",
+      qualifiedName: "funcB",
+      filePath: "src/b.ts",
+      language: "typescript",
+      startLine: 1,
+      endLine: 5,
+      startColumn: 0,
+      endColumn: 0,
+      updatedAt: Date.now()
+    };
+    db.upsertNode(codeNode1);
+    db.upsertNode(codeNode2);
+    createEdge(codeNode1.id, depId, "imports");
+    createEdge(codeNode2.id, depId, "references");
+    createEdge(depId, "some-manifest", "declared_in");
+    const manifestExists = () => false;
+    const result = await integrator.cleanup(manifestExists);
+    (0, import_vitest.expect)(result.nodesRemoved).toBe(1);
+    (0, import_vitest.expect)(result.edgesRemoved).toBe(3);
+  });
+});
+//# sourceMappingURL=integrator.test.js.map

package/dist/security/integrator.test.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../src/security/integrator.test.ts"],
+  "sourcesContent": ["/**\n * Tests for DependencyGraphIntegrator.cleanup()\n *\n * Verifies that orphaned Dependency_Nodes are correctly identified and removed\n * when their source manifests no longer exist on disk or when they have no\n * declared_in edges.\n */\nimport { describe, it, expect, beforeEach, afterEach } from 'vitest';\nimport * as fs from 'fs';\nimport * as path from 'path';\nimport * as os from 'os';\nimport { DependencyGraphIntegrator } from './integrator';\nimport { GraphDatabase } from '../db/database';\nimport type { Node, Edge } from '../types';\n\ndescribe('DependencyGraphIntegrator.cleanup()', () => {\n  let db: GraphDatabase;\n  let integrator: DependencyGraphIntegrator;\n  let tmpDir: string;\n  const projectRoot = '/tmp/test-project';\n\n  beforeEach(() => {\n    tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'kirograph-integrator-test-'));\n    db = new GraphDatabase(tmpDir);\n    db.applySecuritySchema();\n    integrator = new DependencyGraphIntegrator(db, projectRoot);\n  });\n\n  afterEach(() => {\n    db.close();\n    fs.rmSync(tmpDir, { recursive: true, force: true });\n  });\n\n  function createDependencyNode(\n    name: string,\n    ecosystem: string,\n    sourceManifests: string[],\n    options?: { addDeclaredInEdge?: boolean },\n  ): string {\n    const nodeId = `dep:${ecosystem}:${name}`;\n    const rawDb = db.getRawDb();\n\n    const node: Node = {\n      id: nodeId,\n      kind: 'dependency',\n      name,\n      qualifiedName: `${ecosystem}/${name}`,\n      filePath: sourceManifests[0] ?? '',\n      language: 'unknown',\n      startLine: 0,\n      endLine: 0,\n      startColumn: 0,\n      endColumn: 0,\n      isExported: false,\n      isAsync: false,\n      isStatic: false,\n      isAbstract: false,\n      updatedAt: Date.now(),\n    };\n\n    db.upsertNode(node);\n\n    rawDb.run(\n      `INSERT OR REPLACE INTO sec_dependencies\n        (node_id, ecosystem, package_name, declared_constraint, resolved_version, scope, source_manifests)\n       VALUES (?, ?, ?, ?, ?, ?, ?)`,\n      [nodeId, ecosystem, name, '^1.0.0', '1.0.0', 'production', JSON.stringify(sourceManifests)],\n    );\n\n    // Optionally add declared_in edge (simulates a manifest that still declares this dep)\n    if (options?.addDeclaredInEdge !== false) {\n      for (const manifest of sourceManifests) {\n        const edge: Edge = {\n          source: nodeId,\n          target: manifest,\n          kind: 'declared_in',\n        };\n        db.insertEdge(edge);\n      }\n    }\n\n    return nodeId;\n  }\n\n  function createEdge(source: string, target: string, kind: string): void {\n    const edge: Edge = {\n      source,\n      target,\n      kind: kind as Edge['kind'],\n    };\n    db.insertEdge(edge);\n  }\n\n  it('should return zero counts when no dependencies exist', async () => {\n    const result = await integrator.cleanup(() => true);\n    expect(result.nodesRemoved).toBe(0);\n    expect(result.edgesRemoved).toBe(0);\n  });\n\n  it('should not remove dependencies whose manifests still exist and have declared_in edges', async () => {\n    const manifestPath = 'package.json';\n    const nodeId = createDependencyNode('express', 'npm', [manifestPath]);\n\n    const manifestExists = () => true;\n\n    const result = await integrator.cleanup(manifestExists);\n    expect(result.nodesRemoved).toBe(0);\n    expect(result.edgesRemoved).toBe(0);\n\n    const node = db.getNode(nodeId);\n    expect(node).not.toBeNull();\n  });\n\n  it('should remove dependencies with no declared_in edges', async () => {\n    const manifestPath = 'package.json';\n    const nodeId = createDependencyNode('express', 'npm', [manifestPath], {\n      addDeclaredInEdge: false,\n    });\n\n    const manifestExists = () => true;\n\n    const result = await integrator.cleanup(manifestExists);\n    expect(result.nodesRemoved).toBe(1);\n\n    const node = db.getNode(nodeId);\n    expect(node).toBeNull();\n  });\n\n  it('should remove dependencies whose manifests no longer exist on disk', async () => {\n    const manifestPath = 'package.json';\n    const nodeId = createDependencyNode('express', 'npm', [manifestPath]);\n\n    const manifestExists = () => false;\n\n    const result = await integrator.cleanup(manifestExists);\n    expect(result.nodesRemoved).toBe(1);\n\n    const node = db.getNode(nodeId);\n    expect(node).toBeNull();\n  });\n\n  it('should remove edges connected to orphaned nodes', async () => {\n    const manifestPath = 'package.json';\n    const depNodeId = createDependencyNode('lodash', 'npm', [manifestPath], {\n      addDeclaredInEdge: false,\n    });\n\n    const codeNode: Node = {\n      id: 'file:src/index.ts:import:lodash',\n      kind: 'import',\n      name: 'lodash',\n      qualifiedName: 'src/index.ts:lodash',\n      filePath: 'src/index.ts',\n      language: 'typescript',\n      startLine: 1,\n      endLine: 1,\n      startColumn: 0,\n      endColumn: 20,\n      updatedAt: Date.now(),\n    };\n    db.upsertNode(codeNode);\n    createEdge(codeNode.id, depNodeId, 'imports');\n\n    const manifestExists = () => true;\n    const result = await integrator.cleanup(manifestExists);\n    expect(result.nodesRemoved).toBe(1);\n    expect(result.edgesRemoved).toBe(1);\n  });\n\n  it('should keep dependency if at least one source manifest exists on disk', async () => {\n    const manifests = ['packages/a/package.json', 'packages/b/package.json'];\n    const nodeId = createDependencyNode('react', 'npm', manifests);\n\n    const manifestExists = (p: string) => p.includes('packages/a/package.json');\n\n    const result = await integrator.cleanup(manifestExists);\n    expect(result.nodesRemoved).toBe(0);\n\n    const node = db.getNode(nodeId);\n    expect(node).not.toBeNull();\n  });\n\n  it('should remove transitive dependencies no longer reachable from direct deps', async () => {\n    const manifest = 'package.json';\n\n    // Direct dependency (manifest exists, has declared_in edge)\n    const directId = createDependencyNode('express', 'npm', [manifest]);\n\n    // Transitive dependency reachable from express\n    const reachableTransId = createDependencyNode('accepts', 'npm', [manifest]);\n    createEdge(directId, reachableTransId, 'depends_on');\n\n    // Orphaned direct dependency (no declared_in edge)\n    const orphanedDirectId = createDependencyNode('lodash', 'npm', ['old-package.json'], {\n      addDeclaredInEdge: false,\n    });\n\n    // Transitive dependency ONLY reachable from orphaned direct (no declared_in edge)\n    const unreachableTransId = createDependencyNode('lodash.merge', 'npm', ['old-package.json'], {\n      addDeclaredInEdge: false,\n    });\n    createEdge(orphanedDirectId, unreachableTransId, 'depends_on');\n\n    const manifestExists = () => true;\n\n    const result = await integrator.cleanup(manifestExists);\n\n    // lodash and lodash.merge should be removed\n    expect(result.nodesRemoved).toBe(2);\n\n    // express and accepts should remain\n    expect(db.getNode(directId)).not.toBeNull();\n    expect(db.getNode(reachableTransId)).not.toBeNull();\n\n    // orphaned nodes should be gone\n    expect(db.getNode(orphanedDirectId)).toBeNull();\n    expect(db.getNode(unreachableTransId)).toBeNull();\n  });\n\n  it('should handle transitive chains correctly \u2014 all reachable from direct dep', async () => {\n    const manifest = 'package.json';\n\n    const directId = createDependencyNode('express', 'npm', [manifest]);\n\n    // Chain: express \u2192 body-parser \u2192 raw-body \u2192 bytes\n    const bp = createDependencyNode('body-parser', 'npm', [manifest]);\n    const rb = createDependencyNode('raw-body', 'npm', [manifest]);\n    const bytes = createDependencyNode('bytes', 'npm', [manifest]);\n\n    createEdge(directId, bp, 'depends_on');\n    createEdge(bp, rb, 'depends_on');\n    createEdge(rb, bytes, 'depends_on');\n\n    const manifestExists = () => true;\n\n    const result = await integrator.cleanup(manifestExists);\n\n    expect(result.nodesRemoved).toBe(0);\n    expect(result.edgesRemoved).toBe(0);\n  });\n\n  it('should count edges correctly when multiple edges connect to orphaned node', async () => {\n    const orphanedManifest = 'removed/package.json';\n    const depId = createDependencyNode('old-pkg', 'npm', [orphanedManifest], {\n      addDeclaredInEdge: false,\n    });\n\n    const codeNode1: Node = {\n      id: 'node:a',\n      kind: 'function',\n      name: 'funcA',\n      qualifiedName: 'funcA',\n      filePath: 'src/a.ts',\n      language: 'typescript',\n      startLine: 1,\n      endLine: 5,\n      startColumn: 0,\n      endColumn: 0,\n      updatedAt: Date.now(),\n    };\n    const codeNode2: Node = {\n      id: 'node:b',\n      kind: 'function',\n      name: 'funcB',\n      qualifiedName: 'funcB',\n      filePath: 'src/b.ts',\n      language: 'typescript',\n      startLine: 1,\n      endLine: 5,\n      startColumn: 0,\n      endColumn: 0,\n      updatedAt: Date.now(),\n    };\n    db.upsertNode(codeNode1);\n    db.upsertNode(codeNode2);\n\n    createEdge(codeNode1.id, depId, 'imports');\n    createEdge(codeNode2.id, depId, 'references');\n    createEdge(depId, 'some-manifest', 'declared_in');\n\n    // No manifests exist on disk\n    const manifestExists = () => false;\n\n    const result = await integrator.cleanup(manifestExists);\n    expect(result.nodesRemoved).toBe(1);\n    // 2 incoming (imports, references) + 1 outgoing (declared_in) = 3\n    expect(result.edgesRemoved).toBe(3);\n  });\n});\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;AAOA,oBAA4D;AAC5D,SAAoB;AACpB,WAAsB;AACtB,SAAoB;AACpB,wBAA0C;AAC1C,sBAA8B;AAAA,IAG9B,wBAAS,uCAAuC,MAAM;AACpD,MAAI;AACJ,MAAI;AACJ,MAAI;AACJ,QAAM,cAAc;AAEpB,gCAAW,MAAM;AACf,aAAS,GAAG,YAAY,KAAK,KAAK,GAAG,OAAO,GAAG,4BAA4B,CAAC;AAC5E,SAAK,IAAI,8BAAc,MAAM;AAC7B,OAAG,oBAAoB;AACvB,iBAAa,IAAI,4CAA0B,IAAI,WAAW;AAAA,EAC5D,CAAC;AAED,+BAAU,MAAM;AACd,OAAG,MAAM;AACT,OAAG,OAAO,QAAQ,EAAE,WAAW,MAAM,OAAO,KAAK,CAAC;AAAA,EACpD,CAAC;AAED,WAAS,qBACP,MACA,WACA,iBACA,SACQ;AACR,UAAM,SAAS,OAAO,SAAS,IAAI,IAAI;AACvC,UAAM,QAAQ,GAAG,SAAS;AAE1B,UAAM,OAAa;AAAA,MACjB,IAAI;AAAA,MACJ,MAAM;AAAA,MACN;AAAA,MACA,eAAe,GAAG,SAAS,IAAI,IAAI;AAAA,MACnC,UAAU,gBAAgB,CAAC,KAAK;AAAA,MAChC,UAAU;AAAA,MACV,WAAW;AAAA,MACX,SAAS;AAAA,MACT,aAAa;AAAA,MACb,WAAW;AAAA,MACX,YAAY;AAAA,MACZ,SAAS;AAAA,MACT,UAAU;AAAA,MACV,YAAY;AAAA,MACZ,WAAW,KAAK,IAAI;AAAA,IACtB;AAEA,OAAG,WAAW,IAAI;AAElB,UAAM;AAAA,MACJ;AAAA;AAAA;AAAA,MAGA,CAAC,QAAQ,WAAW,MAAM,UAAU,SAAS,cAAc,KAAK,UAAU,eAAe,CAAC;AAAA,IAC5F;AAGA,QAAI,SAAS,sBAAsB,OAAO;AACxC,iBAAW,YAAY,iBAAiB;AACtC,cAAM,OAAa;AAAA,UACjB,QAAQ;AAAA,UACR,QAAQ;AAAA,UACR,MAAM;AAAA,QACR;AACA,WAAG,WAAW,IAAI;AAAA,MACpB;AAAA,IACF;AAEA,WAAO;AAAA,EACT;AAEA,WAAS,WAAW,QAAgB,QAAgB,MAAoB;AACtE,UAAM,OAAa;AAAA,MACjB;AAAA,MACA;AAAA,MACA;AAAA,IACF;AACA,OAAG,WAAW,IAAI;AAAA,EACpB;AAEA,wBAAG,wDAAwD,YAAY;AACrE,UAAM,SAAS,MAAM,WAAW,QAAQ,MAAM,IAAI;AAClD,8BAAO,OAAO,YAAY,EAAE,KAAK,CAAC;AAClC,8BAAO,OAAO,YAAY,EAAE,KAAK,CAAC;AAAA,EACpC,CAAC;AAED,wBAAG,yFAAyF,YAAY;AACtG,UAAM,eAAe;AACrB,UAAM,SAAS,qBAAqB,WAAW,OAAO,CAAC,YAAY,CAAC;AAEpE,UAAM,iBAAiB,MAAM;AAE7B,UAAM,SAAS,MAAM,WAAW,QAAQ,cAAc;AACtD,8BAAO,OAAO,YAAY,EAAE,KAAK,CAAC;AAClC,8BAAO,OAAO,YAAY,EAAE,KAAK,CAAC;AAElC,UAAM,OAAO,GAAG,QAAQ,MAAM;AAC9B,8BAAO,IAAI,EAAE,IAAI,SAAS;AAAA,EAC5B,CAAC;AAED,wBAAG,wDAAwD,YAAY;AACrE,UAAM,eAAe;AACrB,UAAM,SAAS,qBAAqB,WAAW,OAAO,CAAC,YAAY,GAAG;AAAA,MACpE,mBAAmB;AAAA,IACrB,CAAC;AAED,UAAM,iBAAiB,MAAM;AAE7B,UAAM,SAAS,MAAM,WAAW,QAAQ,cAAc;AACtD,8BAAO,OAAO,YAAY,EAAE,KAAK,CAAC;AAElC,UAAM,OAAO,GAAG,QAAQ,MAAM;AAC9B,8BAAO,IAAI,EAAE,SAAS;AAAA,EACxB,CAAC;AAED,wBAAG,sEAAsE,YAAY;AACnF,UAAM,eAAe;AACrB,UAAM,SAAS,qBAAqB,WAAW,OAAO,CAAC,YAAY,CAAC;AAEpE,UAAM,iBAAiB,MAAM;AAE7B,UAAM,SAAS,MAAM,WAAW,QAAQ,cAAc;AACtD,8BAAO,OAAO,YAAY,EAAE,KAAK,CAAC;AAElC,UAAM,OAAO,GAAG,QAAQ,MAAM;AAC9B,8BAAO,IAAI,EAAE,SAAS;AAAA,EACxB,CAAC;AAED,wBAAG,mDAAmD,YAAY;AAChE,UAAM,eAAe;AACrB,UAAM,YAAY,qBAAqB,UAAU,OAAO,CAAC,YAAY,GAAG;AAAA,MACtE,mBAAmB;AAAA,IACrB,CAAC;AAED,UAAM,WAAiB;AAAA,MACrB,IAAI;AAAA,MACJ,MAAM;AAAA,MACN,MAAM;AAAA,MACN,eAAe;AAAA,MACf,UAAU;AAAA,MACV,UAAU;AAAA,MACV,WAAW;AAAA,MACX,SAAS;AAAA,MACT,aAAa;AAAA,MACb,WAAW;AAAA,MACX,WAAW,KAAK,IAAI;AAAA,IACtB;AACA,OAAG,WAAW,QAAQ;AACtB,eAAW,SAAS,IAAI,WAAW,SAAS;AAE5C,UAAM,iBAAiB,MAAM;AAC7B,UAAM,SAAS,MAAM,WAAW,QAAQ,cAAc;AACtD,8BAAO,OAAO,YAAY,EAAE,KAAK,CAAC;AAClC,8BAAO,OAAO,YAAY,EAAE,KAAK,CAAC;AAAA,EACpC,CAAC;AAED,wBAAG,yEAAyE,YAAY;AACtF,UAAM,YAAY,CAAC,2BAA2B,yBAAyB;AACvE,UAAM,SAAS,qBAAqB,SAAS,OAAO,SAAS;AAE7D,UAAM,iBAAiB,CAAC,MAAc,EAAE,SAAS,yBAAyB;AAE1E,UAAM,SAAS,MAAM,WAAW,QAAQ,cAAc;AACtD,8BAAO,OAAO,YAAY,EAAE,KAAK,CAAC;AAElC,UAAM,OAAO,GAAG,QAAQ,MAAM;AAC9B,8BAAO,IAAI,EAAE,IAAI,SAAS;AAAA,EAC5B,CAAC;AAED,wBAAG,8EAA8E,YAAY;AAC3F,UAAM,WAAW;AAGjB,UAAM,WAAW,qBAAqB,WAAW,OAAO,CAAC,QAAQ,CAAC;AAGlE,UAAM,mBAAmB,qBAAqB,WAAW,OAAO,CAAC,QAAQ,CAAC;AAC1E,eAAW,UAAU,kBAAkB,YAAY;AAGnD,UAAM,mBAAmB,qBAAqB,UAAU,OAAO,CAAC,kBAAkB,GAAG;AAAA,MACnF,mBAAmB;AAAA,IACrB,CAAC;AAGD,UAAM,qBAAqB,qBAAqB,gBAAgB,OAAO,CAAC,kBAAkB,GAAG;AAAA,MAC3F,mBAAmB;AAAA,IACrB,CAAC;AACD,eAAW,kBAAkB,oBAAoB,YAAY;AAE7D,UAAM,iBAAiB,MAAM;AAE7B,UAAM,SAAS,MAAM,WAAW,QAAQ,cAAc;AAGtD,8BAAO,OAAO,YAAY,EAAE,KAAK,CAAC;AAGlC,8BAAO,GAAG,QAAQ,QAAQ,CAAC,EAAE,IAAI,SAAS;AAC1C,8BAAO,GAAG,QAAQ,gBAAgB,CAAC,EAAE,IAAI,SAAS;AAGlD,8BAAO,GAAG,QAAQ,gBAAgB,CAAC,EAAE,SAAS;AAC9C,8BAAO,GAAG,QAAQ,kBAAkB,CAAC,EAAE,SAAS;AAAA,EAClD,CAAC;AAED,wBAAG,kFAA6E,YAAY;AAC1F,UAAM,WAAW;AAEjB,UAAM,WAAW,qBAAqB,WAAW,OAAO,CAAC,QAAQ,CAAC;AAGlE,UAAM,KAAK,qBAAqB,eAAe,OAAO,CAAC,QAAQ,CAAC;AAChE,UAAM,KAAK,qBAAqB,YAAY,OAAO,CAAC,QAAQ,CAAC;AAC7D,UAAM,QAAQ,qBAAqB,SAAS,OAAO,CAAC,QAAQ,CAAC;AAE7D,eAAW,UAAU,IAAI,YAAY;AACrC,eAAW,IAAI,IAAI,YAAY;AAC/B,eAAW,IAAI,OAAO,YAAY;AAElC,UAAM,iBAAiB,MAAM;AAE7B,UAAM,SAAS,MAAM,WAAW,QAAQ,cAAc;AAEtD,8BAAO,OAAO,YAAY,EAAE,KAAK,CAAC;AAClC,8BAAO,OAAO,YAAY,EAAE,KAAK,CAAC;AAAA,EACpC,CAAC;AAED,wBAAG,6EAA6E,YAAY;AAC1F,UAAM,mBAAmB;AACzB,UAAM,QAAQ,qBAAqB,WAAW,OAAO,CAAC,gBAAgB,GAAG;AAAA,MACvE,mBAAmB;AAAA,IACrB,CAAC;AAED,UAAM,YAAkB;AAAA,MACtB,IAAI;AAAA,MACJ,MAAM;AAAA,MACN,MAAM;AAAA,MACN,eAAe;AAAA,MACf,UAAU;AAAA,MACV,UAAU;AAAA,MACV,WAAW;AAAA,MACX,SAAS;AAAA,MACT,aAAa;AAAA,MACb,WAAW;AAAA,MACX,WAAW,KAAK,IAAI;AAAA,IACtB;AACA,UAAM,YAAkB;AAAA,MACtB,IAAI;AAAA,MACJ,MAAM;AAAA,MACN,MAAM;AAAA,MACN,eAAe;AAAA,MACf,UAAU;AAAA,MACV,UAAU;AAAA,MACV,WAAW;AAAA,MACX,SAAS;AAAA,MACT,aAAa;AAAA,MACb,WAAW;AAAA,MACX,WAAW,KAAK,IAAI;AAAA,IACtB;AACA,OAAG,WAAW,SAAS;AACvB,OAAG,WAAW,SAAS;AAEvB,eAAW,UAAU,IAAI,OAAO,SAAS;AACzC,eAAW,UAAU,IAAI,OAAO,YAAY;AAC5C,eAAW,OAAO,iBAAiB,aAAa;AAGhD,UAAM,iBAAiB,MAAM;AAE7B,UAAM,SAAS,MAAM,WAAW,QAAQ,cAAc;AACtD,8BAAO,OAAO,YAAY,EAAE,KAAK,CAAC;AAElC,8BAAO,OAAO,YAAY,EAAE,KAAK,CAAC;AAAA,EACpC,CAAC;AACH,CAAC;",
+  "names": []
+}

package/dist/security/license.js

@@ -0,0 +1,70 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var license_exports = {};
+__export(license_exports, {
+  checkLicensePolicy: () => checkLicensePolicy
+});
+module.exports = __toCommonJS(license_exports);
+function matchesPattern(license, pattern) {
+  const lowerLicense = license.toLowerCase();
+  const lowerPattern = pattern.toLowerCase();
+  if (!lowerPattern.includes("*")) {
+    return lowerLicense === lowerPattern;
+  }
+  const regexStr = lowerPattern.replace(/[.+?^${}()|[\]\\]/g, "\\$&").replace(/\*/g, ".*");
+  const regex = new RegExp(`^${regexStr}$`);
+  return regex.test(lowerLicense);
+}
+function matchesAny(license, patterns) {
+  return patterns.some((p) => matchesPattern(license, p));
+}
+function checkLicensePolicy(deps, policy) {
+  const violations = [];
+  for (const dep of deps) {
+    if (!dep.license) continue;
+    const license = dep.license;
+    if (policy.deny.length > 0 && matchesAny(license, policy.deny)) {
+      violations.push({
+        packageName: dep.package_name,
+        ecosystem: dep.ecosystem,
+        license,
+        severity: "deny"
+      });
+    } else if (policy.warn.length > 0 && matchesAny(license, policy.warn)) {
+      violations.push({
+        packageName: dep.package_name,
+        ecosystem: dep.ecosystem,
+        license,
+        severity: "warn"
+      });
+    }
+  }
+  violations.sort((a, b) => {
+    if (a.severity !== b.severity) {
+      return a.severity === "deny" ? -1 : 1;
+    }
+    return a.packageName.localeCompare(b.packageName);
+  });
+  return violations;
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  checkLicensePolicy
+});
+//# sourceMappingURL=license.js.map

package/dist/security/license.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../src/security/license.ts"],
+  "sourcesContent": ["/**\n * License Compliance Checker for KiroGraph-Sec\n *\n * Checks project dependencies against a license policy (deny/warn lists).\n * Supports case-insensitive matching and wildcard patterns (e.g. GPL-* matches\n * GPL-2.0, GPL-3.0-only, etc.).\n */\n\n// \u2500\u2500 Types \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\nexport interface LicenseViolation {\n  packageName: string;\n  ecosystem: string;\n  license: string;\n  severity: 'deny' | 'warn';\n}\n\n// \u2500\u2500 Wildcard matching \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\n/**\n * Test whether a license string matches a policy pattern.\n * Matching is case-insensitive. The pattern may contain `*` as a wildcard\n * (matches any sequence of characters).\n */\nfunction matchesPattern(license: string, pattern: string): boolean {\n  const lowerLicense = license.toLowerCase();\n  const lowerPattern = pattern.toLowerCase();\n\n  if (!lowerPattern.includes('*')) {\n    return lowerLicense === lowerPattern;\n  }\n\n  // Convert wildcard pattern to regex\n  // Escape regex special chars except *, then replace * with .*\n  const regexStr = lowerPattern\n    .replace(/[.+?^${}()|[\\]\\\\]/g, '\\\\$&')\n    .replace(/\\*/g, '.*');\n  const regex = new RegExp(`^${regexStr}$`);\n  return regex.test(lowerLicense);\n}\n\n/**\n * Test whether a license matches any pattern in the list.\n */\nfunction matchesAny(license: string, patterns: string[]): boolean {\n  return patterns.some(p => matchesPattern(license, p));\n}\n\n// \u2500\u2500 Main check function \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\n/**\n * Check a list of dependencies against a license policy.\n *\n * Dependencies with no license are skipped (no violation).\n * A license matched in `deny` produces a 'deny' violation.\n * A license matched in `warn` (and not in `deny`) produces a 'warn' violation.\n *\n * @param deps - Array of dependency rows from sec_dependencies\n * @param policy - The license policy with deny and warn lists\n * @returns Array of violations sorted by severity (deny first) then package name\n */\nexport function checkLicensePolicy(\n  deps: Array<{ package_name: string; ecosystem: string; license: string | null }>,\n  policy: { deny: string[]; warn: string[] },\n): LicenseViolation[] {\n  const violations: LicenseViolation[] = [];\n\n  for (const dep of deps) {\n    if (!dep.license) continue;\n\n    const license = dep.license;\n\n    if (policy.deny.length > 0 && matchesAny(license, policy.deny)) {\n      violations.push({\n        packageName: dep.package_name,\n        ecosystem: dep.ecosystem,\n        license,\n        severity: 'deny',\n      });\n    } else if (policy.warn.length > 0 && matchesAny(license, policy.warn)) {\n      violations.push({\n        packageName: dep.package_name,\n        ecosystem: dep.ecosystem,\n        license,\n        severity: 'warn',\n      });\n    }\n  }\n\n  // Sort: deny first, then warn; within each group sort by package name\n  violations.sort((a, b) => {\n    if (a.severity !== b.severity) {\n      return a.severity === 'deny' ? -1 : 1;\n    }\n    return a.packageName.localeCompare(b.packageName);\n  });\n\n  return violations;\n}\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAwBA,SAAS,eAAe,SAAiB,SAA0B;AACjE,QAAM,eAAe,QAAQ,YAAY;AACzC,QAAM,eAAe,QAAQ,YAAY;AAEzC,MAAI,CAAC,aAAa,SAAS,GAAG,GAAG;AAC/B,WAAO,iBAAiB;AAAA,EAC1B;AAIA,QAAM,WAAW,aACd,QAAQ,sBAAsB,MAAM,EACpC,QAAQ,OAAO,IAAI;AACtB,QAAM,QAAQ,IAAI,OAAO,IAAI,QAAQ,GAAG;AACxC,SAAO,MAAM,KAAK,YAAY;AAChC;AAKA,SAAS,WAAW,SAAiB,UAA6B;AAChE,SAAO,SAAS,KAAK,OAAK,eAAe,SAAS,CAAC,CAAC;AACtD;AAeO,SAAS,mBACd,MACA,QACoB;AACpB,QAAM,aAAiC,CAAC;AAExC,aAAW,OAAO,MAAM;AACtB,QAAI,CAAC,IAAI,QAAS;AAElB,UAAM,UAAU,IAAI;AAEpB,QAAI,OAAO,KAAK,SAAS,KAAK,WAAW,SAAS,OAAO,IAAI,GAAG;AAC9D,iBAAW,KAAK;AAAA,QACd,aAAa,IAAI;AAAA,QACjB,WAAW,IAAI;AAAA,QACf;AAAA,QACA,UAAU;AAAA,MACZ,CAAC;AAAA,IACH,WAAW,OAAO,KAAK,SAAS,KAAK,WAAW,SAAS,OAAO,IAAI,GAAG;AACrE,iBAAW,KAAK;AAAA,QACd,aAAa,IAAI;AAAA,QACjB,WAAW,IAAI;AAAA,QACf;AAAA,QACA,UAAU;AAAA,MACZ,CAAC;AAAA,IACH;AAAA,EACF;AAGA,aAAW,KAAK,CAAC,GAAG,MAAM;AACxB,QAAI,EAAE,aAAa,EAAE,UAAU;AAC7B,aAAO,EAAE,aAAa,SAAS,KAAK;AAAA,IACtC;AACA,WAAO,EAAE,YAAY,cAAc,EAAE,WAAW;AAAA,EAClD,CAAC;AAED,SAAO;AACT;",
+  "names": []
+}

package/dist/security/manifest/adapter.js

@@ -0,0 +1,243 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var adapter_exports = {};
+__export(adapter_exports, {
+  SecurityManifestAdapter: () => SecurityManifestAdapter
+});
+module.exports = __toCommonJS(adapter_exports);
+var fs = __toESM(require("fs"));
+var path = __toESM(require("path"));
+var import_manifest = require("../../architecture/manifest/index");
+const SKIP_DIRS = /* @__PURE__ */ new Set([
+  "node_modules",
+  ".git",
+  "dist",
+  "build",
+  "target",
+  ".gradle",
+  "__pycache__",
+  ".kirograph",
+  "vendor",
+  ".cache",
+  "coverage",
+  ".nyc_output",
+  "_build",
+  "_opam",
+  "elm-stuff",
+  "zig-cache",
+  "zig-out"
+]);
+class SecurityManifestAdapter {
+  constructor(projectRoot) {
+    this.plugins = /* @__PURE__ */ new Map();
+    /** Standalone plugins have no corresponding architecture parser — they own their own discovery. */
+    this.standalonePlugins = /* @__PURE__ */ new Map();
+    this.projectRoot = projectRoot;
+    this.archParsers = (0, import_manifest.getAllManifestParsers)();
+  }
+  /**
+   * Register a version extraction plugin for an ecosystem that has a
+   * corresponding architecture parser. The plugin's `ecosystem` field
+   * must equal the architecture parser's `name` for the lookup to work.
+   */
+  registerPlugin(plugin) {
+    this.plugins.set(plugin.ecosystem, plugin);
+  }
+  /**
+   * Register a standalone version extraction plugin for an ecosystem that
+   * has NO corresponding architecture parser. The plugin's `manifestFiles`
+   * list drives discovery — the adapter will scan for those filenames and
+   * invoke the plugin directly when found.
+   */
+  registerStandalonePlugin(plugin) {
+    this.standalonePlugins.set(plugin.ecosystem, plugin);
+  }
+  /**
+   * Get all registered version extraction plugins (wrapped + standalone).
+   */
+  getPlugins() {
+    return [...this.plugins.values(), ...this.standalonePlugins.values()];
+  }
+  /**
+   * Get the architecture parsers being wrapped.
+   */
+  getArchParsers() {
+    return this.archParsers;
+  }
+  /**
+   * Discover all manifest files in the project tree.
+   * Includes files known to architecture parsers AND files from standalone plugins.
+   * Returns absolute paths.
+   */
+  discoverManifests() {
+    return this._findManifests(this.projectRoot);
+  }
+  /**
+   * Run full discovery and extraction:
+   * 1. Discover manifest files (reusing architecture's SKIP_DIRS logic)
+   * 2. For each manifest, find the matching architecture parser
+   * 3. If a version extraction plugin is registered for that ecosystem,
+   *    use it to extract detailed version/scope information
+   * 4. Otherwise, fall back to basic extraction from the architecture parser's
+   *    ArchPackage.externalDeps (names only, no version info)
+   */
+  async extractAll() {
+    const manifestPaths = this.discoverManifests();
+    const allDeps = [];
+    const warnings = [];
+    const errors = [];
+    let manifestsParsed = 0;
+    for (const manifestPath of manifestPaths) {
+      const archParser = this.archParsers.find((p) => p.canParse(manifestPath));
+      if (!archParser) continue;
+      const relManifest = path.relative(this.projectRoot, manifestPath).replace(/\\/g, "/");
+      const plugin = this.plugins.get(archParser.name);
+      if (plugin && plugin.canExtract(manifestPath)) {
+        try {
+          const deps = await plugin.extract(manifestPath, this.projectRoot);
+          allDeps.push(...deps);
+          manifestsParsed++;
+        } catch (err) {
+          const message = err instanceof Error ? err.message : String(err);
+          errors.push({ file: relManifest, message });
+        }
+      } else {
+        try {
+          const packages = await archParser.parse(manifestPath, this.projectRoot);
+          const deps = this._fallbackExtract(packages, archParser.name, relManifest);
+          allDeps.push(...deps);
+          manifestsParsed++;
+          if (!plugin) {
+            warnings.push({
+              file: relManifest,
+              message: `No version extraction plugin registered for ecosystem '${archParser.name}'; dependency names extracted without version constraints`
+            });
+          }
+        } catch (err) {
+          const message = err instanceof Error ? err.message : String(err);
+          errors.push({ file: relManifest, message });
+        }
+      }
+    }
+    return {
+      dependenciesCreated: allDeps.length,
+      manifestsParsed,
+      warnings,
+      errors
+    };
+  }
+  /**
+   * Extract dependencies for a single manifest file.
+   * Tries standalone plugins first (when there is no arch parser), then
+   * wrapped plugins, then falls back to arch parser output.
+   */
+  async extractFromManifest(manifestPath) {
+    const archParser = this.archParsers.find((p) => p.canParse(manifestPath));
+    if (!archParser) {
+      const standalonePlugin = [...this.standalonePlugins.values()].find((p) => p.canExtract(manifestPath));
+      if (standalonePlugin) {
+        return standalonePlugin.extract(manifestPath, this.projectRoot);
+      }
+      return [];
+    }
+    const plugin = this.plugins.get(archParser.name);
+    if (plugin && plugin.canExtract(manifestPath)) {
+      return plugin.extract(manifestPath, this.projectRoot);
+    }
+    const packages = await archParser.parse(manifestPath, this.projectRoot);
+    const relManifest = path.relative(this.projectRoot, manifestPath).replace(/\\/g, "/");
+    return this._fallbackExtract(packages, archParser.name, relManifest);
+  }
+  /**
+   * Get the ecosystem name for a given manifest file path.
+   * Returns undefined if no parser handles this file.
+   */
+  getEcosystem(manifestPath) {
+    const parser = this.archParsers.find((p) => p.canParse(manifestPath));
+    return parser?.name;
+  }
+  // ── Private helpers ───────────────────────────────────────────────────────
+  /**
+   * Fallback extraction: converts ArchPackage.externalDeps (names only) into
+   * ParsedDependency records with empty version constraints and default scope.
+   */
+  _fallbackExtract(packages, ecosystem, sourceManifest) {
+    const deps = [];
+    for (const pkg of packages) {
+      if (!pkg.externalDeps) continue;
+      for (const depName of pkg.externalDeps) {
+        deps.push({
+          name: depName,
+          declaredConstraint: "*",
+          scope: "production",
+          ecosystem,
+          sourceManifest
+        });
+      }
+    }
+    return deps;
+  }
+  /**
+   * Walk the project directory tree looking for manifest files.
+   * Mirrors the architecture module's _findManifests() logic, respecting SKIP_DIRS.
+   * Includes manifest filenames from standalone plugins in addition to arch parsers.
+   */
+  _findManifests(dir, results = []) {
+    const manifestFilenames = /* @__PURE__ */ new Set([
+      ...this.archParsers.flatMap((p) => p.manifestFiles),
+      ...Array.from(this.standalonePlugins.values()).flatMap((p) => p.manifestFiles)
+    ]);
+    return this._walkDir(dir, manifestFilenames, results);
+  }
+  _walkDir(dir, manifestFilenames, results) {
+    let entries;
+    try {
+      entries = fs.readdirSync(dir, { withFileTypes: true });
+    } catch {
+      return results;
+    }
+    for (const entry of entries) {
+      if (entry.isDirectory()) {
+        if (!SKIP_DIRS.has(entry.name)) {
+          this._walkDir(path.join(dir, entry.name), manifestFilenames, results);
+        }
+      } else if (entry.isFile()) {
+        if (manifestFilenames.has(entry.name) || entry.name.endsWith(".csproj")) {
+          results.push(path.join(dir, entry.name));
+        }
+      }
+    }
+    return results;
+  }
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  SecurityManifestAdapter
+});
+//# sourceMappingURL=adapter.js.map

package/dist/security/manifest/adapter.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../src/security/manifest/adapter.ts"],
+  "sourcesContent": ["/**\n * SecurityManifestAdapter\n *\n * Wraps the existing architecture manifest parsers (11 parsers: npm, cargo, go,\n * gradle, maven, csproj, python, scala, elm, ocaml) to additionally extract\n * version constraints and dependency scopes that the architecture module does\n * not capture.\n *\n * The architecture parsers discover manifest files and extract package names into\n * `ArchPackage.externalDeps`. This adapter reuses that discovery infrastructure\n * and layers version/scope extraction on top via ecosystem-specific plugins.\n */\nimport * as fs from 'fs';\nimport * as path from 'path';\nimport { getAllManifestParsers } from '../../architecture/manifest/index';\nimport type { ManifestParser as ArchManifestParser, ArchPackage } from '../../architecture/types';\nimport type { ParsedDependency, ManifestParseResult } from '../types';\n\n// \u2500\u2500 Plugin Interface \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\n/**\n * A version extraction plugin provides ecosystem-specific logic to extract\n * version constraints and scopes from manifest files. Each plugin corresponds\n * to one or more architecture parsers and enhances their output with security-\n * relevant metadata.\n */\nexport interface VersionExtractionPlugin {\n  /** Ecosystem identifier matching the architecture parser name (e.g. 'npm', 'maven', 'go') */\n  ecosystem: string;\n  /** Manifest filenames this plugin handles (should match the architecture parser's manifestFiles) */\n  manifestFiles: string[];\n  /** Returns true if this plugin can handle the given manifest file path */\n  canExtract(manifestPath: string): boolean;\n  /**\n   * Extract version constraints and scopes from a manifest file.\n   * This is called AFTER the architecture parser has already discovered the manifest.\n   * The plugin receives the manifest path and project root, and returns detailed\n   * dependency information including versions and scopes.\n   */\n  extract(manifestPath: string, projectRoot: string): Promise<ParsedDependency[]>;\n}\n\n// \u2500\u2500 Directories to skip (mirrors architecture module's SKIP_DIRS) \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\nconst SKIP_DIRS = new Set([\n  'node_modules', '.git', 'dist', 'build', 'target', '.gradle', '__pycache__',\n  '.kirograph', 'vendor', '.cache', 'coverage', '.nyc_output', '_build', '_opam',\n  'elm-stuff', 'zig-cache', 'zig-out',\n]);\n\n// \u2500\u2500 SecurityManifestAdapter \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\nexport class SecurityManifestAdapter {\n  private readonly archParsers: ArchManifestParser[];\n  private readonly plugins: Map<string, VersionExtractionPlugin> = new Map();\n  /** Standalone plugins have no corresponding architecture parser \u2014 they own their own discovery. */\n  private readonly standalonePlugins: Map<string, VersionExtractionPlugin> = new Map();\n  private readonly projectRoot: string;\n\n  constructor(projectRoot: string) {\n    this.projectRoot = projectRoot;\n    this.archParsers = getAllManifestParsers();\n  }\n\n  /**\n   * Register a version extraction plugin for an ecosystem that has a\n   * corresponding architecture parser. The plugin's `ecosystem` field\n   * must equal the architecture parser's `name` for the lookup to work.\n   */\n  registerPlugin(plugin: VersionExtractionPlugin): void {\n    this.plugins.set(plugin.ecosystem, plugin);\n  }\n\n  /**\n   * Register a standalone version extraction plugin for an ecosystem that\n   * has NO corresponding architecture parser. The plugin's `manifestFiles`\n   * list drives discovery \u2014 the adapter will scan for those filenames and\n   * invoke the plugin directly when found.\n   */\n  registerStandalonePlugin(plugin: VersionExtractionPlugin): void {\n    this.standalonePlugins.set(plugin.ecosystem, plugin);\n  }\n\n  /**\n   * Get all registered version extraction plugins (wrapped + standalone).\n   */\n  getPlugins(): VersionExtractionPlugin[] {\n    return [...this.plugins.values(), ...this.standalonePlugins.values()];\n  }\n\n  /**\n   * Get the architecture parsers being wrapped.\n   */\n  getArchParsers(): ArchManifestParser[] {\n    return this.archParsers;\n  }\n\n  /**\n   * Discover all manifest files in the project tree.\n   * Includes files known to architecture parsers AND files from standalone plugins.\n   * Returns absolute paths.\n   */\n  discoverManifests(): string[] {\n    return this._findManifests(this.projectRoot);\n  }\n\n  /**\n   * Run full discovery and extraction:\n   * 1. Discover manifest files (reusing architecture's SKIP_DIRS logic)\n   * 2. For each manifest, find the matching architecture parser\n   * 3. If a version extraction plugin is registered for that ecosystem,\n   *    use it to extract detailed version/scope information\n   * 4. Otherwise, fall back to basic extraction from the architecture parser's\n   *    ArchPackage.externalDeps (names only, no version info)\n   */\n  async extractAll(): Promise<ManifestParseResult> {\n    const manifestPaths = this.discoverManifests();\n    const allDeps: ParsedDependency[] = [];\n    const warnings: Array<{ file: string; line?: number; message: string }> = [];\n    const errors: Array<{ file: string; message: string }> = [];\n    let manifestsParsed = 0;\n\n    for (const manifestPath of manifestPaths) {\n      const archParser = this.archParsers.find(p => p.canParse(manifestPath));\n      if (!archParser) continue;\n\n      const relManifest = path.relative(this.projectRoot, manifestPath).replace(/\\\\/g, '/');\n      const plugin = this.plugins.get(archParser.name);\n\n      if (plugin && plugin.canExtract(manifestPath)) {\n        // Use the version extraction plugin for detailed parsing\n        try {\n          const deps = await plugin.extract(manifestPath, this.projectRoot);\n          allDeps.push(...deps);\n          manifestsParsed++;\n        } catch (err) {\n          const message = err instanceof Error ? err.message : String(err);\n          errors.push({ file: relManifest, message });\n        }\n      } else {\n        // Fallback: use architecture parser output (names only, no versions)\n        try {\n          const packages = await archParser.parse(manifestPath, this.projectRoot);\n          const deps = this._fallbackExtract(packages, archParser.name, relManifest);\n          allDeps.push(...deps);\n          manifestsParsed++;\n\n          if (!plugin) {\n            warnings.push({\n              file: relManifest,\n              message: `No version extraction plugin registered for ecosystem '${archParser.name}'; dependency names extracted without version constraints`,\n            });\n          }\n        } catch (err) {\n          const message = err instanceof Error ? err.message : String(err);\n          errors.push({ file: relManifest, message });\n        }\n      }\n    }\n\n    return {\n      dependenciesCreated: allDeps.length,\n      manifestsParsed,\n      warnings,\n      errors,\n    };\n  }\n\n  /**\n   * Extract dependencies for a single manifest file.\n   * Tries standalone plugins first (when there is no arch parser), then\n   * wrapped plugins, then falls back to arch parser output.\n   */\n  async extractFromManifest(manifestPath: string): Promise<ParsedDependency[]> {\n    const archParser = this.archParsers.find(p => p.canParse(manifestPath));\n\n    if (!archParser) {\n      // No arch parser \u2014 try standalone plugins\n      const standalonePlugin = [...this.standalonePlugins.values()]\n        .find(p => p.canExtract(manifestPath));\n      if (standalonePlugin) {\n        return standalonePlugin.extract(manifestPath, this.projectRoot);\n      }\n      return [];\n    }\n\n    const plugin = this.plugins.get(archParser.name);\n\n    if (plugin && plugin.canExtract(manifestPath)) {\n      return plugin.extract(manifestPath, this.projectRoot);\n    }\n\n    // Fallback: architecture parser output (names only)\n    const packages = await archParser.parse(manifestPath, this.projectRoot);\n    const relManifest = path.relative(this.projectRoot, manifestPath).replace(/\\\\/g, '/');\n    return this._fallbackExtract(packages, archParser.name, relManifest);\n  }\n\n  /**\n   * Get the ecosystem name for a given manifest file path.\n   * Returns undefined if no parser handles this file.\n   */\n  getEcosystem(manifestPath: string): string | undefined {\n    const parser = this.archParsers.find(p => p.canParse(manifestPath));\n    return parser?.name;\n  }\n\n  // \u2500\u2500 Private helpers \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\n  /**\n   * Fallback extraction: converts ArchPackage.externalDeps (names only) into\n   * ParsedDependency records with empty version constraints and default scope.\n   */\n  private _fallbackExtract(\n    packages: ArchPackage[],\n    ecosystem: string,\n    sourceManifest: string,\n  ): ParsedDependency[] {\n    const deps: ParsedDependency[] = [];\n    for (const pkg of packages) {\n      if (!pkg.externalDeps) continue;\n      for (const depName of pkg.externalDeps) {\n        deps.push({\n          name: depName,\n          declaredConstraint: '*',\n          scope: 'production',\n          ecosystem,\n          sourceManifest,\n        });\n      }\n    }\n    return deps;\n  }\n\n  /**\n   * Walk the project directory tree looking for manifest files.\n   * Mirrors the architecture module's _findManifests() logic, respecting SKIP_DIRS.\n   * Includes manifest filenames from standalone plugins in addition to arch parsers.\n   */\n  private _findManifests(dir: string, results: string[] = []): string[] {\n    const manifestFilenames = new Set([\n      ...this.archParsers.flatMap(p => p.manifestFiles),\n      ...Array.from(this.standalonePlugins.values()).flatMap(p => p.manifestFiles),\n    ]);\n\n    return this._walkDir(dir, manifestFilenames, results);\n  }\n\n  private _walkDir(dir: string, manifestFilenames: Set<string>, results: string[]): string[] {\n    let entries: fs.Dirent[];\n    try {\n      entries = fs.readdirSync(dir, { withFileTypes: true });\n    } catch {\n      return results;\n    }\n\n    for (const entry of entries) {\n      if (entry.isDirectory()) {\n        if (!SKIP_DIRS.has(entry.name)) {\n          this._walkDir(path.join(dir, entry.name), manifestFilenames, results);\n        }\n      } else if (entry.isFile()) {\n        if (manifestFilenames.has(entry.name) || entry.name.endsWith('.csproj')) {\n          results.push(path.join(dir, entry.name));\n        }\n      }\n    }\n\n    return results;\n  }\n}\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAYA,SAAoB;AACpB,WAAsB;AACtB,sBAAsC;AA8BtC,MAAM,YAAY,oBAAI,IAAI;AAAA,EACxB;AAAA,EAAgB;AAAA,EAAQ;AAAA,EAAQ;AAAA,EAAS;AAAA,EAAU;AAAA,EAAW;AAAA,EAC9D;AAAA,EAAc;AAAA,EAAU;AAAA,EAAU;AAAA,EAAY;AAAA,EAAe;AAAA,EAAU;AAAA,EACvE;AAAA,EAAa;AAAA,EAAa;AAC5B,CAAC;AAIM,MAAM,wBAAwB;AAAA,EAOnC,YAAY,aAAqB;AALjC,SAAiB,UAAgD,oBAAI,IAAI;AAEzE;AAAA,SAAiB,oBAA0D,oBAAI,IAAI;AAIjF,SAAK,cAAc;AACnB,SAAK,kBAAc,uCAAsB;AAAA,EAC3C;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,eAAe,QAAuC;AACpD,SAAK,QAAQ,IAAI,OAAO,WAAW,MAAM;AAAA,EAC3C;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,yBAAyB,QAAuC;AAC9D,SAAK,kBAAkB,IAAI,OAAO,WAAW,MAAM;AAAA,EACrD;AAAA;AAAA;AAAA;AAAA,EAKA,aAAwC;AACtC,WAAO,CAAC,GAAG,KAAK,QAAQ,OAAO,GAAG,GAAG,KAAK,kBAAkB,OAAO,CAAC;AAAA,EACtE;AAAA;AAAA;AAAA;AAAA,EAKA,iBAAuC;AACrC,WAAO,KAAK;AAAA,EACd;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,oBAA8B;AAC5B,WAAO,KAAK,eAAe,KAAK,WAAW;AAAA,EAC7C;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWA,MAAM,aAA2C;AAC/C,UAAM,gBAAgB,KAAK,kBAAkB;AAC7C,UAAM,UAA8B,CAAC;AACrC,UAAM,WAAoE,CAAC;AAC3E,UAAM,SAAmD,CAAC;AAC1D,QAAI,kBAAkB;AAEtB,eAAW,gBAAgB,eAAe;AACxC,YAAM,aAAa,KAAK,YAAY,KAAK,OAAK,EAAE,SAAS,YAAY,CAAC;AACtE,UAAI,CAAC,WAAY;AAEjB,YAAM,cAAc,KAAK,SAAS,KAAK,aAAa,YAAY,EAAE,QAAQ,OAAO,GAAG;AACpF,YAAM,SAAS,KAAK,QAAQ,IAAI,WAAW,IAAI;AAE/C,UAAI,UAAU,OAAO,WAAW,YAAY,GAAG;AAE7C,YAAI;AACF,gBAAM,OAAO,MAAM,OAAO,QAAQ,cAAc,KAAK,WAAW;AAChE,kBAAQ,KAAK,GAAG,IAAI;AACpB;AAAA,QACF,SAAS,KAAK;AACZ,gBAAM,UAAU,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAC/D,iBAAO,KAAK,EAAE,MAAM,aAAa,QAAQ,CAAC;AAAA,QAC5C;AAAA,MACF,OAAO;AAEL,YAAI;AACF,gBAAM,WAAW,MAAM,WAAW,MAAM,cAAc,KAAK,WAAW;AACtE,gBAAM,OAAO,KAAK,iBAAiB,UAAU,WAAW,MAAM,WAAW;AACzE,kBAAQ,KAAK,GAAG,IAAI;AACpB;AAEA,cAAI,CAAC,QAAQ;AACX,qBAAS,KAAK;AAAA,cACZ,MAAM;AAAA,cACN,SAAS,0DAA0D,WAAW,IAAI;AAAA,YACpF,CAAC;AAAA,UACH;AAAA,QACF,SAAS,KAAK;AACZ,gBAAM,UAAU,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAC/D,iBAAO,KAAK,EAAE,MAAM,aAAa,QAAQ,CAAC;AAAA,QAC5C;AAAA,MACF;AAAA,IACF;AAEA,WAAO;AAAA,MACL,qBAAqB,QAAQ;AAAA,MAC7B;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,oBAAoB,cAAmD;AAC3E,UAAM,aAAa,KAAK,YAAY,KAAK,OAAK,EAAE,SAAS,YAAY,CAAC;AAEtE,QAAI,CAAC,YAAY;AAEf,YAAM,mBAAmB,CAAC,GAAG,KAAK,kBAAkB,OAAO,CAAC,EACzD,KAAK,OAAK,EAAE,WAAW,YAAY,CAAC;AACvC,UAAI,kBAAkB;AACpB,eAAO,iBAAiB,QAAQ,cAAc,KAAK,WAAW;AAAA,MAChE;AACA,aAAO,CAAC;AAAA,IACV;AAEA,UAAM,SAAS,KAAK,QAAQ,IAAI,WAAW,IAAI;AAE/C,QAAI,UAAU,OAAO,WAAW,YAAY,GAAG;AAC7C,aAAO,OAAO,QAAQ,cAAc,KAAK,WAAW;AAAA,IACtD;AAGA,UAAM,WAAW,MAAM,WAAW,MAAM,cAAc,KAAK,WAAW;AACtE,UAAM,cAAc,KAAK,SAAS,KAAK,aAAa,YAAY,EAAE,QAAQ,OAAO,GAAG;AACpF,WAAO,KAAK,iBAAiB,UAAU,WAAW,MAAM,WAAW;AAAA,EACrE;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,aAAa,cAA0C;AACrD,UAAM,SAAS,KAAK,YAAY,KAAK,OAAK,EAAE,SAAS,YAAY,CAAC;AAClE,WAAO,QAAQ;AAAA,EACjB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQQ,iBACN,UACA,WACA,gBACoB;AACpB,UAAM,OAA2B,CAAC;AAClC,eAAW,OAAO,UAAU;AAC1B,UAAI,CAAC,IAAI,aAAc;AACvB,iBAAW,WAAW,IAAI,cAAc;AACtC,aAAK,KAAK;AAAA,UACR,MAAM;AAAA,UACN,oBAAoB;AAAA,UACpB,OAAO;AAAA,UACP;AAAA,UACA;AAAA,QACF,CAAC;AAAA,MACH;AAAA,IACF;AACA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOQ,eAAe,KAAa,UAAoB,CAAC,GAAa;AACpE,UAAM,oBAAoB,oBAAI,IAAI;AAAA,MAChC,GAAG,KAAK,YAAY,QAAQ,OAAK,EAAE,aAAa;AAAA,MAChD,GAAG,MAAM,KAAK,KAAK,kBAAkB,OAAO,CAAC,EAAE,QAAQ,OAAK,EAAE,aAAa;AAAA,IAC7E,CAAC;AAED,WAAO,KAAK,SAAS,KAAK,mBAAmB,OAAO;AAAA,EACtD;AAAA,EAEQ,SAAS,KAAa,mBAAgC,SAA6B;AACzF,QAAI;AACJ,QAAI;AACF,gBAAU,GAAG,YAAY,KAAK,EAAE,eAAe,KAAK,CAAC;AAAA,IACvD,QAAQ;AACN,aAAO;AAAA,IACT;AAEA,eAAW,SAAS,SAAS;AAC3B,UAAI,MAAM,YAAY,GAAG;AACvB,YAAI,CAAC,UAAU,IAAI,MAAM,IAAI,GAAG;AAC9B,eAAK,SAAS,KAAK,KAAK,KAAK,MAAM,IAAI,GAAG,mBAAmB,OAAO;AAAA,QACtE;AAAA,MACF,WAAW,MAAM,OAAO,GAAG;AACzB,YAAI,kBAAkB,IAAI,MAAM,IAAI,KAAK,MAAM,KAAK,SAAS,SAAS,GAAG;AACvE,kBAAQ,KAAK,KAAK,KAAK,KAAK,MAAM,IAAI,CAAC;AAAA,QACzC;AAAA,MACF;AAAA,IACF;AAEA,WAAO;AAAA,EACT;AACF;",
+  "names": []
+}